fix: scope login audit records by tenant

server/db/mysql/tenant_security_audit_test.go

@@ -0,0 +1,26 @@
+//go:build mysql
+
+package mysql
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestLoginAuditQueriesAreTenantScoped(t *testing.T) {
+	source, err := os.ReadFile("tenant_security_audit.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(source)
+	for _, required := range []string{
+		"(tenant_id,user_id,username",
+		"(tenant_id,user_id,account_type",
+		"WHERE tenant_id=? AND session_id=?",
+	} {
+		if !strings.Contains(body, required) {
+			t.Fatalf("login audit query is missing tenant scope %q", required)
+		}
+	}
+}